mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-04-17 22:48:28 +00:00
Code Issues Projects Releases Wiki Activity

python3-pillow: fix CVE-2021-34552

Browse Source 
Pull fix from version 8.3.1 back to 8.2.0.

Signed-off-by: Joe Slater <joe.slater@windriver.com>
This commit is contained in:
Joe Slater
2021-07-22 09:39:38 -07:00
committed by Armin Kuster
parent 76a6070e68
commit 88813d34dd
3 changed files with 94 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

49
meta-python/recipes-devtools/python/python3-pillow/0001-Limit-sprintf-modes-to-10-characters.patch Normal file
View File

@@ -0,0 +1,49 @@
From 5f4504bb03f4edeeef8c2633dc5ba03a4c2a8a97 Mon Sep 17 00:00:00 2001
From: Andrew Murray <radarhere@users.noreply.github.com>
Date: Tue, 15 Jun 2021 15:14:26 +1000
Subject: [PATCH 1/1] Limit sprintf modes to 10 characters
Needed to make CVE-2021-34552 fix apply cleanly.
commit 5f4504bb03f4edeeef8c2633dc5ba03a4c2a8a97 (unmodified)
Upstream-Status: Backport
Signed-off-by: Joe Slater <joe.slater@windriver.com>
---
src/libImaging/Convert.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/src/libImaging/Convert.c b/src/libImaging/Convert.c
index 8c7be36a2..1fa74a13b 100644
--- a/src/libImaging/Convert.c
+++ b/src/libImaging/Convert.c
@@ -1594,9 +1594,8 @@ convert(
#ifdef notdef
return (Imaging)ImagingError_ValueError("conversion not supported");
#else
- static char buf[256];
- /* FIXME: may overflow if mode is too large */
- sprintf(buf, "conversion from %s to %s not supported", imIn->mode, mode);
+ static char buf[100];
+ sprintf(buf, "conversion from %.10s to %.10s not supported", imIn->mode, mode);
return (Imaging)ImagingError_ValueError(buf);
#endif
}
@@ -1645,11 +1644,10 @@ ImagingConvertTransparent(Imaging imIn, const char *mode, int r, int g, int b) {
}
#else
{
- static char buf[256];
- /* FIXME: may overflow if mode is too large */
+ static char buf[100];
sprintf(
buf,
- "conversion from %s to %s not supported in convert_transparent",
+ "conversion from %.10s to %.10s not supported in convert_transparent",
imIn->mode,
mode);
return (Imaging)ImagingError_ValueError(buf);
--
2.29.2

43
meta-python/recipes-devtools/python/python3-pillow/0001-Use-snprintf-instead-of-sprintf.patch Normal file
View File

@@ -0,0 +1,43 @@
From 518ee3722a99d7f7d890db82a20bd81c1c0327fb Mon Sep 17 00:00:00 2001
From: Andrew Murray <radarhere@users.noreply.github.com>
Date: Wed, 30 Jun 2021 23:47:10 +1000
Subject: [PATCH 1/1] Use snprintf instead of sprintf
Fix CVE-2021-34552.
commit 518ee3722a99d7f7d890db82a20bd81c1c0327fb (unmodified)
Upstream-Status: Backport
Signed-off-by: Joe Slater <joe.slater@windriver.com>
---
src/libImaging/Convert.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/src/libImaging/Convert.c b/src/libImaging/Convert.c
index 1fa74a13b..9012cfcd7 100644
--- a/src/libImaging/Convert.c
+++ b/src/libImaging/Convert.c
@@ -1595,7 +1595,7 @@ convert(
return (Imaging)ImagingError_ValueError("conversion not supported");
#else
static char buf[100];
- sprintf(buf, "conversion from %.10s to %.10s not supported", imIn->mode, mode);
+ snprintf(buf, 100, "conversion from %.10s to %.10s not supported", imIn->mode, mode);
return (Imaging)ImagingError_ValueError(buf);
#endif
}
@@ -1645,8 +1645,9 @@ ImagingConvertTransparent(Imaging imIn, const char *mode, int r, int g, int b) {
#else
{
static char buf[100];
- sprintf(
+ snprintf(
buf,
+ 100,
"conversion from %.10s to %.10s not supported in convert_transparent",
imIn->mode,
mode);
--
2.29.2

2
meta-python/recipes-devtools/python/python3-pillow_8.2.0.bb
View File

@@ -8,6 +8,8 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=0337b116233da4616ae9fdb130bf6f1a"
SRC_URI = "git://github.com/python-pillow/Pillow.git;branch=8.2.x \
file://0001-support-cross-compiling.patch \
file://0001-explicitly-set-compile-options.patch \
file://0001-Limit-sprintf-modes-to-10-characters.patch \
file://0001-Use-snprintf-instead-of-sprintf.patch \
"
SRCREV ?= "e0e353c0ef7516979a9aedce3792596649ce4433"